netdev - Re: [RFC] arp announce, arp_proxy and windows ip conflict verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 30 Jun 2009 15:55:59 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Denys Fedoryschenko <denys@...p.net.lb>
Cc:	netdev@...r.kernel.org, David Miller <davem@...emloft.net>
Subject: Re: [RFC] arp announce, arp_proxy and windows ip conflict verification

Denys Fedoryschenko <denys@...p.net.lb> writes:

> Windows (XP at least) hosts on boot, with configured static ip, performing 
> address conflict detection, which is defined in RFC3927.
> Here is quote of important information:
>
> "
> An ARP announcement is identical to the ARP Probe described above, 
> except    that now the sender and target IP addresses are both set 
> to the host's newly selected IPv4 address. 
> "
>
> But it same time this goes wrong with RFC5227.
> "
> The 'sender IP address' field MUST be set to all zeroes; this is to avoid
> polluting ARP caches in other hosts on the same link in the case
> where the address turns out to be already in use by another host.
> "
>
> When ARP proxy configured, it must not answer to both cases, because 
> it is address conflict verification in any case. For Windows it is just 
> causing to detect false "ip conflict". Already there is code for RFC5227, so 
> just trivially we just check also if source ip == target ip.

I have a problem with this patch.  It stops gratuitous arps updating
my arp cache.  I'm still trying to figure out what the correct behaviour
should be.

Perhaps making the goto out; become if (sip == 0) goto out;

Eric



>
> Signed-off-by: Denys Fedoryshchenko <denys@...p.net.lb>
> ---
>
> diff --git a/net-next-2.6/net/ipv4/arp.c b/linux-net-next-a/net/ipv4/arp.c
> index 3f6b735..5afaf2a 100644
> --- a/net-next-2.6/net/ipv4/arp.c
> +++ b/linux-net-next-a/net/ipv4/arp.c
> @@ -801,8 +801,11 @@ static int arp_process(struct sk_buff *skb)
>   *  cache.
>   */
>  
> -	/* Special case: IPv4 duplicate address detection packet (RFC2131) */
> -	if (sip == 0) {
> +	/* 
> +	*  Special case: IPv4 duplicate address detection packet (RFC2131)
> +	*  and Gratuitous ARP/ARP Announce. (RFC3927, Section 2.4) 
> +	*/
> +	if (sip == 0 || tip == sip) {
>  		if (arp->ar_op == htons(ARPOP_REQUEST) &&
>  		    inet_addr_type(net, tip) == RTN_LOCAL &&
>  		    !arp_ignore(in_dev, sip, tip))
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html